mlsanityData to 7 Oct 2026

Lethal Dose Conjecture on Data Poisoning

arXiv 2208.03309 ↗First posted 5 Aug 2022cs.LG cs.AI cs.CRcited by 12

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Data poisoning considers an adversary that distorts the training set of machine learning algorithms for malicious purposes. In this work, we bring to light one conjecture regarding the fundamentals of data poisoning, which we call the Lethal Dose Conjecture. The conjecture states: If n clean training samples are needed for accurate predictions, then in a size-N training set, only Theta(N/n) poisoned samples can be tolerated while ensuring accuracy. Theoretically, we verify this conjecture in multiple cases. We also offer a more general perspective of this conjecture through distribution discrimination. Deep Partition Aggregation (DPA) and its extension, Finite Aggregation (FA) are recent approaches for provable defenses against data poisoning, where they predict through the majority vote of many base models trained from different subsets of training set using a given learner. The conjecture implies that both DPA and FA are (asymptotically) optimal -- if we have the most data-efficient learner, they can turn it into one of the most robust defenses against data poisoning. This outlines a practical approach to developing stronger defenses against poisoning via finding data-efficient learners. Empirically, as a proof of concept, we show that by simply using different data augmentations for base learners, we can respectively double and triple the certified robustness of DPA on CIFAR-10 and GTSRB without sacrificing accuracy.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 29 of its 43 references that are in the map. First posted on arXiv 5 Aug 2022.

Builds on

29 of 43 references.

Closest ancestors · 2

Same direction, newest first

  1. 2022Robustly-reliable learners under poisoning attacks8 Mar
  2. 2022Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation5 Feb

Other references · 27

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2013Network In Networkcited by 600
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2018Spectral Signatures in Backdoor Attackscited by 457
  8. 2019Hidden Trigger Backdoor Attackscited by 359
  9. 2017Certified Defenses for Data Poisoning Attackscited by 288
  10. 2019Label-Consistent Backdoor Attackscited by 285
  11. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  12. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
15 more
  1. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  2. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 123
  3. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  4. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  5. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  6. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  7. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  8. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 75
  9. 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
  10. 2016Achieving Human Parity in Conversational Speech Recognitioncited by 63
  11. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  12. 2018The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measurecited by 44
  13. 2018Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detectioncited by 43
  14. 2021Learning and Certification under Instance-targeted Poisoningcited by 13
  15. 2020A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attackscited by 12

Built on by

Cited by year

Citing papers per year: 2023: 7; 2024: 3; 2025: 2.

12 papers.

  1. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  2. 2023Run-Off Election: Improved Provable Defense against Data Poisoning Attackscited by 16
  3. 2024Dialectical Alignment: Resolving the Tension of 3H and Security Threats of LLMscited by 11
  4. 2023Temporal Robustness against Data Poisoningcited by 10
  5. 2024lpNTK: Better Generalisation with Less Data via Sample Interaction During Learningcited by 6
  6. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  7. 2023What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?cited by 3
  8. 2024The poison of dimensionalitycited by 3
  9. 2023On Practical Aspects of Aggregation Defenses against Data Poisoning Attackscited by 1
  10. 2023Understanding Variation in Subpopulation Susceptibility to Poisoning Attackscited by 1
  11. 2025Provably Robust Adaptation for Language-Empowered Foundation Modelscited by 0
  12. 2025On Robustness of Linear Classifiers to Targeted Data Poisoningcited by 0